5

I have a set a domain computer to not require a password on wakeup. This is a strange situation I know but we want the user to never have to login to the computer unless he specifically logs out or restarts the computer.

This itself works, however when the user returns to the computer the next day and is still logged in, the computer seems to have lost its authentication with the server and when attempting to open the shared drives and folders the user is asked for a username and password. Aside from entering the credentials which we don't want him to have to do, the only thing that fixes is it is a restart.

Is the session expiring on the server or something, how can we fix this?

Reafidy
  • 319
  • 1
  • 7
  • 18

1 Answers1

9

You probably are running into the default Kerberos user ticket expiration time - which is 10 hours by default. Technically, if you really need the authentication to never expire, you might set the expiration time for user tickets to 0 (turning off expiration):

enter image description here

Note that this is a domain-wide setting with severe security implications. Anybody who has acquired a valid Kerberos user ticket will be able to hold it indefinitely and use it as a valid authenticator. You really should know what you are doing here.

the-wabbit
  • 40,737
  • 13
  • 111
  • 174
  • Okay, I see your point, I was hoping this could have been a user specific setting, I don't really want to change this for the whole domain. Back to the drawing board I guess. – Reafidy Nov 23 '13 at 08:27
  • @Reafidy it is worth temporarily setting the lifetime to a higher value (e.g. 72 hours) to see if this is indeed your problem. – the-wabbit Nov 23 '13 at 09:25
  • Took a while to test but this appeared to be the issue. Thanks. We have just set the screen timeout to 5 hours so they are forced to login once a day. – Reafidy Dec 04 '13 at 19:41